CVE-2025-29927

Think of Next.js middleware like the “bouncer” at the door to certain pages in your app. This bug lets a stranger walk past the bouncer without showing the right permission, so they may reach areas you meant to keep private. The practical risk is that protected content—like customer data or admin features—could be accessed.

This matters if you run a Next.js application that relies on middleware to protect routes (for example, admin pages, user-only dashboards, or any protected API endpoints). You should treat it as a risk even without any special user action because the attack is remote and does not require authentication. Fixing is especially important once the vulnerable middleware logic is reachable from the internet—reachability in default configuration is not confirmed in the findings, so you should assume you may be exposed if your app’s middleware-protected routes can be reached publicly.

This is RED because a remote, unauthenticated attacker can bypass authorization checks, and there is a public proof-of-concept available. The fixes exist (Next.js 12.3.5 and next 13.5.9), and the risk is not theoretical—attackers can target protected resources directly. Treat this as an urgent upgrade priority on your next maintenance window, or sooner if you have internet-facing protected routes.